Not rated
Exploited
CVE-2024-45195 Apache OFBiz Forced Browsing Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-425
Description
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OFBiz 18.12 | earliest → < 18.12.16 | 18.12.16 |
| Apache OFBiz 18.12 | earliest → < 18.12.16 | 18.12.16 |
References
- ofbiz.apache.org ofbiz.apache.org
- ofbiz.apache.org ofbiz.apache.org
- issues.apache.org issues.apache.org
- lists.apache.org lists.apache.org
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of OFBiz
The 11 CVEs of OFBiz →
CVE-2024-48962
Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper…
8.9
High
CVE-2024-38856
Apache OFBiz Incorrect Authorization Vulnerability
Not rated
CVE-2024-32113
Apache OFBiz Path Traversal Vulnerability
Not rated
CVE-2024-23946
Possible path traversal in Apache OFBiz allowing file inclusion
Not rated